@bensandee/tooling 0.43.0 → 0.44.0

package/README.md

@@ -96,6 +96,7 @@ To skip a workflow file entirely, add `# @bensandee/tooling:ignore` as the first
 | `tooling release:trigger`        | Trigger a release workflow.                                                                                                                   |
 | `tooling forgejo:create-release` | Create a Forgejo release from a tag.                                                                                                          |
 | `tooling changesets:merge`       | Merge a changesets version PR.                                                                                                                |
+| `tooling webhook:send <url>`     | POST to a webhook URL with HMAC-SHA256 auth. Secret from `WEBHOOK_SECRET` env var.                                                            |
 
 #### `release:simple`
 

package/dist/bin.mjs

@@ -11,6 +11,7 @@ import { parse } from "jsonc-parser";
 import { z } from "zod";
 import { FatalError, TransientError, UnexpectedError } from "@bensandee/common";
 import { isMap, isScalar, parse as parse$1, parseDocument, stringify, visit } from "yaml";
+import { createHmac } from "node:crypto";
 import picomatch from "picomatch";
 import { tmpdir } from "node:os";
 //#region src/types.ts
@@ -626,7 +627,7 @@ const ToolingConfigSchema = z.strictObject({
 	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" }),
 	registryHost: z.string().optional().meta({ description: "Docker registry hostname (e.g. ghcr.io, code.example.com)" }),
 	registryNamespace: z.string().optional().meta({ description: "Docker registry namespace (e.g. ghcr.io/myorg, code.example.com/myorg)" }),
-	postReleaseHook: z.string().optional().meta({ description: "Override the post-release hook command (default: curl POST_RELEASE_HOOK_URL secret if set)" }),
+	postReleaseHook: z.string().optional().meta({ description: "Override the post-release hook command (default: POST to POST_RELEASE_HOOK_URL with HMAC-SHA256 auth)" }),
 	postReleaseHookSecrets: z.array(z.string()).optional().meta({ description: "Additional secret names to inject as env vars in the post-release hook step (e.g. ['WEBHOOK_SECRET'])" })
 });
 /** Load saved tooling config from the target directory. Returns undefined if missing, throws on invalid. */
@@ -1571,7 +1572,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.10.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.43.0";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.44.0";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.12.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
@@ -2181,16 +2182,14 @@ async function generateGitignore(ctx) {
 //#region src/generators/release-ci.ts
 const DEFAULT_POST_RELEASE_COMMAND = [
 	"if [ -n \"$POST_RELEASE_HOOK_URL\" ]; then",
-	" curl -fsS -X POST",
-	" $",
-	"{POST_RELEASE_HOOK_SECRET:+-H \"Authorization: Bearer $POST_RELEASE_HOOK_SECRET\"}",
+	" pnpm dlx @bensandee/tooling webhook:send",
 	" \"$POST_RELEASE_HOOK_URL\"; fi"
 ].join("");
-/** Build env vars for hook secrets to inject into a Release step (for runtime hook execution). */
+/** Build env vars for hook secrets to inject into a workflow step. */
 function hookSecretEnv(secrets) {
 	const env = {
 		POST_RELEASE_HOOK_URL: actionsExpr("secrets.POST_RELEASE_HOOK_URL"),
-		POST_RELEASE_HOOK_SECRET: actionsExpr("secrets.POST_RELEASE_HOOK_SECRET")
+		WEBHOOK_SECRET: actionsExpr("secrets.POST_RELEASE_HOOK_SECRET")
 	};
 	for (const name of secrets ?? []) env[name] = actionsExpr(`secrets.${name}`);
 	return env;
@@ -3333,7 +3332,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.43.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.44.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -4240,6 +4239,64 @@ async function runVersionMode(executor, config) {
 	};
 }
 //#endregion
+//#region src/release/webhook.ts
+/**
+* Compute the HMAC-SHA256 hex digest of data using the given secret.
+* Returns the signature in GitHub-style format: `sha256=<hex>`.
+*/
+function computeSignature(secret, data) {
+	const hmac = createHmac("sha256", secret);
+	hmac.update(data);
+	return `sha256=${hmac.digest("hex")}`;
+}
+/**
+* POST to a webhook URL with GitHub-style HMAC-SHA256 authentication.
+*
+* Sends an empty body. If a secret is provided, computes the HMAC-SHA256
+* signature and includes it in the `X-Hub-Signature-256` header.
+*
+* Never throws — returns a result object indicating success or failure.
+*/
+async function sendWebhook(options) {
+	const { url, secret, fetcher = globalThis.fetch } = options;
+	const body = "";
+	const headers = { "Content-Type": "application/json" };
+	if (secret) headers["X-Hub-Signature-256"] = computeSignature(secret, body);
+	try {
+		const response = await fetcher(url, {
+			method: "POST",
+			headers,
+			body
+		});
+		if (!response.ok) return {
+			ok: false,
+			status: response.status,
+			error: `HTTP ${String(response.status)}: ${await response.text().catch(() => "")}`
+		};
+		return {
+			ok: true,
+			status: response.status
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Send a webhook and log the result. Intended for CLI usage.
+* Never throws.
+*/
+async function sendWebhookWithLogging(url, secret) {
+	const result = await sendWebhook({
+		url,
+		secret
+	});
+	if (result.ok) log.info("Post-release hook completed successfully");
+	else log.warn(`Post-release hook failed: ${result.error ?? "unknown error"}`);
+}
+//#endregion
 //#region src/release/hook.ts
 const PostReleaseHookSchema = z.object({ postReleaseHook: z.string().optional() });
 /** Read the postReleaseHook command override from .tooling.json at runtime. */
@@ -4259,12 +4316,12 @@ function loadHookCommand(executor, cwd) {
 * Execute the post-release hook after a successful publish.
 *
 * Uses the `postReleaseHook` command from `.tooling.json` if configured,
-* otherwise curls `POST_RELEASE_HOOK_URL` with optional Bearer auth from
-* `POST_RELEASE_HOOK_SECRET`. Both env vars must be set by the CI workflow.
+* otherwise POSTs to `POST_RELEASE_HOOK_URL` with HMAC-SHA256 authentication
+* using `WEBHOOK_SECRET`. Both env vars must be set by the CI workflow.
 *
 * Failures are logged as warnings — they never fail the release.
 */
-function runPostReleaseHook(executor, config) {
+async function runPostReleaseHook(executor, config) {
 	if (config.dryRun) {
 		debug(config, "Skipping post-release hook (dry-run)");
 		return;
@@ -4280,22 +4337,15 @@ function runPostReleaseHook(executor, config) {
 		debug(config, "No POST_RELEASE_HOOK_URL set — skipping post-release hook");
 		return;
 	}
-	const hookSecret = process.env["POST_RELEASE_HOOK_SECRET"];
-	const args = [
-		"-fsS",
-		"-X",
-		"POST"
-	];
-	if (hookSecret) args.push("-H", `Authorization: Bearer ${hookSecret}`);
-	args.push(hookUrl);
-	debug(config, `Running post-release hook: curl ${args.map((a) => a.includes(" ") ? `"${a}"` : a).join(" ")}`);
-	try {
-		const result = executor.exec("curl", args, { cwd: config.cwd });
-		if (result.exitCode !== 0) log.warn(`Post-release hook failed (exit code ${String(result.exitCode)}): ${result.stderr || result.stdout}`);
-		else log.info("Post-release hook completed successfully");
-	} catch (error) {
-		log.warn(`Post-release hook error: ${error instanceof Error ? error.message : String(error)}`);
-	}
+	const hookSecret = process.env["WEBHOOK_SECRET"];
+	debug(config, `Running post-release hook: POST ${hookUrl}`);
+	const result = await sendWebhook({
+		url: hookUrl,
+		secret: hookSecret || void 0,
+		fetcher: executor.fetch.bind(executor)
+	});
+	if (result.ok) log.info("Post-release hook completed successfully");
+	else log.warn(`Post-release hook failed: ${result.error ?? "unknown error"}`);
 }
 function executeHookCommand(executor, config, command) {
 	try {
@@ -4406,7 +4456,7 @@ async function runPublishMode(executor, config) {
 		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
 		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
 	}
-	runPostReleaseHook(executor, config);
+	await runPostReleaseHook(executor, config);
 	return {
 		mode: "publish",
 		tags: allTags
@@ -4830,7 +4880,7 @@ async function runSimpleRelease(executor, config) {
 	}
 	let releaseCreated = false;
 	if (!config.noRelease && config.platform) releaseCreated = await createPlatformRelease(executor, config, tag);
-	if (pushed) runPostReleaseHook(executor, config);
+	if (pushed) await runPostReleaseHook(executor, config);
 	return {
 		version,
 		tag,
@@ -5955,11 +6005,28 @@ const forgejoSecretsCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/webhook-send.ts
+const webhookSendCommand = defineCommand({
+	meta: {
+		name: "webhook:send",
+		description: "Send a POST request to a webhook URL with GitHub-style HMAC-SHA256 authentication"
+	},
+	args: { url: {
+		type: "positional",
+		description: "Webhook URL to POST to",
+		required: true
+	} },
+	async run({ args }) {
+		const secret = process.env["WEBHOOK_SECRET"];
+		await sendWebhookWithLogging(args.url, secret || void 0);
+	}
+});
+//#endregion
 //#region src/bin.ts
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.43.0",
+		version: "0.44.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -5975,10 +6042,11 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand,
 		"hooks:audit": hooksAuditCommand,
 		"setup:secrets": setupSecretsCommand,
-		"forgejo:secrets": forgejoSecretsCommand
+		"forgejo:secrets": forgejoSecretsCommand,
+		"webhook:send": webhookSendCommand
 	}
 });
-console.log(`@bensandee/tooling v0.43.0`);
+console.log(`@bensandee/tooling v0.44.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -54,8 +54,8 @@
     "prettier": "3.8.1",
     "release-it": "19.2.4",
     "tsdown": "0.21.6",
-    "@bensandee/claude-hooks": "0.6.1",
-    "@bensandee/config": "0.10.1"
+    "@bensandee/config": "0.10.1",
+    "@bensandee/claude-hooks": "0.6.1"
   },
   "scripts": {
     "build": "tsdown",

package/tooling.schema.json

@@ -170,7 +170,7 @@
       "type": "string"
     },
     "postReleaseHook": {
-      "description": "Override the post-release hook command (default: curl POST_RELEASE_HOOK_URL secret if set)",
+      "description": "Override the post-release hook command (default: POST to POST_RELEASE_HOOK_URL with HMAC-SHA256 auth)",
       "type": "string"
     },
     "postReleaseHookSecrets": {